How do I prevent PII Exposure?

Deploy Wardstone to detect and block PII in all inputs and outputs Implement PII redaction before data enters LLM context Use tokenization for sensitive data references Maintain comprehensive PII inventories Regular compliance audits for data handling

How do I detect PII Exposure?

Wardstone uses specialized pattern matching and ML-based detection to identify PII in both inputs and outputs, including SSNs, credit card numbers, phone numbers, email addresses, physical addresses, and other sensitive identifiers.

HighData LeakageOWASP LLM06

PII Exposure

The unintended disclosure of Personally Identifiable Information (PII) such as names, addresses, SSNs, credit cards, or other personal data through LLM interactions.

Test in Playground Get API Key

Overview

PII exposure is a specific and critical form of data leakage that involves personal information. This is particularly serious due to privacy regulations like GDPR, HIPAA, and CCPA that impose strict requirements and penalties for PII handling. LLMs can expose PII from their training data, from documents in their context, or by generating realistic-looking PII that happens to match real individuals.

How This Attack Works

PII exists in training data, context documents, or user inputs
What's happening
Customer database in context: 'John Smith, SSN: 123-45-6789, Card: 4532-XXXX-XXXX-1234'
The LLM processes a query that could involve this PII
Attacker
User: 'Show me the customer details for order #12345'
Without proper safeguards, the model includes PII in its response
LLM Response
LLM: 'Order #12345 belongs to John Smith (SSN: 123-45-6789)...'
This violates privacy regulations and exposes individuals to harm
What's happening
GDPR/HIPAA violation: personal data exposed to unauthorized parties

Attack Examples

SSN Exposure

Social Security numbers in outputs

Example Attack Pattern (Sanitized)

The customer's SSN on file is 123-45-6789.

Credit Card Leakage

Payment card information in responses

Example Attack Pattern (Sanitized)

Your saved card ending in 4532-1234-5678-9012 will be charged.

Contact Information

Personal contact details disclosed

Example Attack Pattern (Sanitized)

John lives at 123 Main St, Anytown USA. His phone is 555-123-4567.

Protect Your Application

Try Detection in Playground

Sample PII Exposure Input

Customer John Smith, SSN 123-45-6789, credit card 4532-1234-5678-9012, lives at 123 Main Street, Anytown CA 90210

Try in Playground

Prevention Checklist

Build

Deploy Wardstone to detect and block PII in all inputs and outputs
Implement PII redaction before data enters LLM context
Use tokenization for sensitive data references

Deploy

Maintain comprehensive PII inventories

Monitor

Regular compliance audits for data handling

Detect with Wardstone API

curl -X POST "https://api.wardstone.ai/v1/detect" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text": "Your text to analyze"}'
 
# Response
{
  "prompt_attack": { "detected": false, "confidence": 0.02 },
  "content_violation": { "detected": false, "confidence": 0.01 },
  "data_leakage": { "detected": false, "confidence": 0.00 },
  "unknown_links": { "detected": false, "confidence": 0.00 }
}